Our defense strategy is motivated by the observation that models with backdoor attacks tend to overfit the trigger rather than the actual image [1]}. Specifically, in GAN's training, the discriminator overfits the trigger and perfectly classifies fake and real images, while the generator does not receive effective feedback from the discriminator and then yields high loss and even diverges. Mathematically, as the discriminator overfits on the trigger, \(\log {(1-D(G(z|y)))}\)  in equation REF  will ultimately over-shots and corrupt the performance of GAN. The locally corrupted GAN gradually contaminates other benign clients through the global aggregation. To this end, we propose to defend against backdoor attacks from the global level by leveraging malicious detection.
